Apache Apache-Airflow-Providers-Cncf-Kubernetes vulnerabilities

3 CVEs affecting Apache Apache-Airflow-Providers-Cncf-Kubernetes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-27173, published 2026-05-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-33234, published 2023-05-30. High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days. Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a…
CVE-2023-51702, published 2024-01-24. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it…
CVE-2026-27173, published 2026-05-19. High severity, CVSS 8.7. EPSS: 0.2% chance of exploitation in the next 30 days. JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform…